PT-2019-12194 · Bonobo · Bonobo Git Server

Published 2019-04-24 · Updated 2021-07-21 · CVE-2019-11218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bonobo Git Server versions prior to 6.5.0

Description The issue arises from improper handling of extra parameters in the AccountController, specifically in the User Profile edit functionality. This allows authenticated users to submit additional form parameters and potentially gain application administrator privileges.

Recommendations For versions prior to 6.5.0, update to version 6.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the User Profile edit functionality in the AccountController to prevent potential exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-11218

Affected Products

Bonobo Git Server

References · 4

• https://osv.dev/vulnerability/CVE-2019-11218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11218 · Security Note
• https://flab.cesnet.cz/advisories/cve-2019-11218 · Note
• https://bonobogitserver.com/changelog/#version-650 · Note